6th European Conference - Academic Conferences

Rain Ottis
Last, but not least, it is very difficult to attribute these attacks to a state, as they can (seem to) be a
true (global) grass roots campaign, even if there is some form of state sponsorship. Some states may
take advantage of this fact by allowing such activity to continue in their jurisdiction, blaming legal
obstacles or lack of capability for their inactivity. It is also possible for government operatives to
“create” a “grass roots” Forum movement in support of the government agenda. (Ottis 2009)
2.3 Weaknesses
A clear weakness of this model is the difficulty to command and control the Forum. Membership is not
formalized and often it is even not visible on the communication platform, because passive readers
can just take ideas from there and execute the attacks on their own. This uncoordinated approach can
seriously hamper the effectiveness of the group as a whole. It may also lead to uncontrolled
expansion of conflict, when members unilaterally attack third parties on behalf of the Forum.
A problem with the loose network is that it is often populated with people who do not have experience
with cyber attacks. Therefore, their options are limited to primitive manual attacks or preconfigured
automated attacks using attack kits or malware. (Ottis 2010a) They are highly reliant on instructions
and tools from more experienced members of the Forum.
The Forum is also prone to infiltration, as it must rely on relatively easily accessible communication
channels. If the communication point is hidden, the group will have difficulties in recruiting new
members. The assumption is, therefore, that the communication point can be easily found by both
potential recruits, as well as infiltrators. Since there is no easy way to vet the incoming members,
infiltration should be relatively simple.
Another potential weakness of the Forum model is the presumption of anonymity. If the membership
can be infiltrated and convinced that their anonymity is not guaranteed, they will be less likely to
participate in the cyber militia. Options for achieving this can include “exposing” the “identities” of the
infiltrators, arranging meetings in real life, offering tools that have a phone-home functionality to the
members, etc. Note that some of these options may be illegal, depending on the circumstances. (Ottis
2010b)
3. The cell
Another model for a volunteer cyber force that has been seen is a hacker cell. In this case, the
generic term hacker is used to encompass all manner of people who perform cyber attacks on their
own, regardless of their background, motivation and skill level. It includes the hackers, crackers and
script kiddies described by Young and Aitel (2004). The hacker cell includes several hackers who
commit cyber attacks on a regular basis over extended periods of time. Examples of hacker cells are
Team Evil and Team Hell, as described in Carr (2009).
3.1 Attributes
Unlike the Forum, the Cell members are likely to know each other in real life, while remaining
anonymous to the outside observer. Since their activities are almost certainly illegal, they need to trust
each other. This limits the size of the group and requires a (lengthy) vetting procedure for any new
recruits. The vetting procedure can include proof of illegal cyber attacks.
The command and control structure of the Cell can vary from a clear self-determined hierarchy to a
flat organization, where members coordinate their actions, but do not give or receive orders. In theory,
several Cells can coordinate their actions in a joint campaign, forming a confederation of hacker cells.
The Cells can exist for a long period of time, in response to a long-term problem, such as the Israel-
Palestine conflict. The activity of such a Cell ebbs and flows in accordance with the intensity of the
underlying conflict. The Cell may even disband for a period of time, only to reform once the situation
intensifies again.
Since hacking is a hobby (potentially a profession) for the members, they are experienced with the
use of cyber attacks. One of the more visible types of attacks that can be expected from a Cell is the
website defacement. Defacement refers to the illegal modification of website content, which often
includes a message from the attacker, as well as the attacker’s affiliation. The Zone-H web archive
309